ci(github-action): update action docker/setup-buildx-action (37fe631 → 594f3bf)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-buildx-action (changelog)	action	digest	37fe631 → 594f3bf

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation

Approve. This is a routine Renovate digest bump for docker/setup-buildx-action (commit 37fe631 → 594f3bf, both pinned to # v4). The change is mechanical, scoped, and consistent with the repo's existing pinned-action pattern.

Change-by-change findings

• .github/workflows/ci.yaml (line 34): digest updated from 37fe631… to 594f3bf…; the trailing # v4 comment is preserved. The step is used solely to provision BuildKit before docker/build-push-action runs — a digest bump on the same major version is non-breaking.
• .github/workflows/release.yaml (line 19): the identical digest bump is applied here, paired with docker/login-action and docker/build-push-action. Same risk profile: same major (v4), same usage pattern.

Both edits keep the action pinned to a full commit SHA with a trailing version comment, which is the convention already in force across .github/workflows/ (e.g., actions/checkout@3d3c42e… # v7, actions/setup-python@5fda3b95… # v7.0.0, pypa/gh-action-pip-audit@… # v1.1.0). No YAML structural changes, no new inputs, no new secrets, no path/auth/serving surface changes. No Dockerfile or image digest changes (Image Digest Provenance confirms no container image digests were touched).

Repository history corroborates the pattern: the immediately prior bump on the same action landed in commit ed2c878 (bb05f3f → 37fe631, PR PR 178), and other Renovate digest updates for sibling actions have merged cleanly (e.g., PR 333 docker/build-push-action, PR 327 codeql-action, PR 324/PR 308/PR 290 pr-reviewer-action).

Standards Compliance

AGENTS.md governs how agents must file issues (single-sentence imperative ask + named concrete file paths). This PR is a Renovate dependency update, not an agent-issued change, so the filing rails are not applicable to its content. The diff itself does conform to repository conventions:

• Pinned by full commit SHA + trailing major-version comment — matches every other uses: line scanned in .github/workflows/.
• No unrelated edits, no scope drift — both touched files are exactly the files named in the PR title.
• Branch name renovate/docker-setup-buildx-action-digest follows the established Renovate branch naming convention.

Tool Harness Findings

No native tool calls were issued; the harness reviewed the corpus directly. No additional automated signals beyond what the corpus already surfaces.

CI Status

CI for commit 74953b4c is timeout at the overall level (the overall run did not finish in time), but the per-check breakdown is otherwise green: review ×2 success, test success, docker success. The only remaining check, renovate/stability-days, is pending — a Renovate branch-protection gate that typically waits on the stability-days window. This is the expected state for an in-flight Renovate PR and not a signal against the change.

Unknowns or Needs Verification

• Exact source changes between 37fe631… and 594f3bf… (compare metadata fetch failed). I cannot enumerate the upstream diff from the corpus; however, the action is pinned to a SHA and used with no inputs, so any diff within the v4 major is unlikely to affect this workflow's behavior. Verification can wait for CI to clear renovate/stability-days and the workflow to execute.
• The PR body carries the standard Renovate "could not be looked up" warning and points at the Dependency Dashboard (issue PR 7). That is informational, not a defect in this PR.

Must-check

The classifier emitted must_check: []; no mandatory checklist items were assigned. The pr_kind app_code with empty risk_flags matches the surface — a dependency-pin edit to two CI workflows with no auth, routing, path-handling, secret, migration, or serving-exposure changes.